2021, Andrew Martin, Michael Hausenblas, Hacking Kubernetes[1], O'Reilly Media, →ISBN:
Intrusion detection can inspect file, network, and kernel reads and writes to verify or block them with an allowlist or a denylist (as seccomp-bpf configuration does).
2022, Jennifer Minella, Wireless Security Architecture[…][2], John Wiley & Sons, →ISBN:
Remediation can entail contacting the user and instructing them to cease; it could be autoremediation by reconfiguring a managed endpoint, or it could be to denylist the device MAC address(es).